sudo joe /etc/apparmor.d/abstractions/libvirt-qem
that it looks like
...
# for usb access
/dev/bus/usb/ rw,
/etc/udev/udev.conf r,
/sys/bus/ r,
/sys/class/ r,
/dev/bus/usb/*/[0-9]* rw,
/run/udev/** rw,
...
# ecryptfs-recover-private .Private
# mount -o remount,rw /path/to/.../.Private /tmp/ecryptfs.XXXXXXXX